chore(deps): bump the dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the dependencies group with 7 updates in the / directory:

Package	From	To
oras-project/setup-oras	2.0.1	2.0.2
github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml	2.0.0	2.2.0
revanite-io/osps-baseline-action	1.5.0	1.5.2
github/codeql-action/init	4.38.0	4.38.2
github/codeql-action/analyze	4.38.0	4.38.2
step-security/harden-runner	2.21.1	2.22.0
release-drafter/release-drafter	7.7.0	7.9.0

Updates oras-project/setup-oras from 2.0.1 to 2.0.2

Release notes

Sourced from oras-project/setup-oras's releases.

v2.0.2

Highlights

• Support ORAS CLI version(s): 1.3.4

What's Changed

• chore(deps): Bump @​types/node from 26.1.0 to 26.1.1 by @​dependabot[bot] in oras-project/setup-oras#187
• chore(deps): Bump typescript from 6.0.3 to 7.0.2 by @​dependabot[bot] in oras-project/setup-oras#186
• chore(deps): Bump actions/setup-node from 6 to 7 by @​dependabot[bot] in oras-project/setup-oras#188
• chore(deps): Bump @​types/node from 26.1.1 to 26.1.2 by @​dependabot[bot] in oras-project/setup-oras#189
• fix: bump undici to >=8.5.0 to resolve dependabot alerts by @​TerryHowe in oras-project/setup-oras#185
• chore(deps): Bump esbuild from 0.28.1 to 0.28.2 by @​dependabot[bot] in oras-project/setup-oras#191
• chore(deps): Bump @​types/node from 26.1.2 to 26.2.0 by @​dependabot[bot] in oras-project/setup-oras#190
• chore: update releases.json for 1.3.4 by @​github-actions[bot] in oras-project/setup-oras#192
• chore(deps): Bump @​types/node from 26.2.0 to 26.4.0 by @​dependabot[bot] in oras-project/setup-oras#193
• chore(deps): Bump apache/skywalking-eyes from 0.8.0 to 0.9.0 by @​dependabot[bot] in oras-project/setup-oras#194
• chore(deps): Bump @​types/node from 26.4.0 to 26.4.1 by @​dependabot[bot] in oras-project/setup-oras#196
• Raise the undici override floor to 8.9.0 by @​arpitjain099 in oras-project/setup-oras#200
• chore(deps): Bump @​types/node from 26.4.1 to 26.5.1 by @​dependabot[bot] in oras-project/setup-oras#201
• chore(deps): Bump @​types/node from 26.5.1 to 26.6.1 by @​dependabot[bot] in oras-project/setup-oras#202
• chore(deps): Bump @​types/node from 26.6.1 to 26.6.2 by @​dependabot[bot] in oras-project/setup-oras#203
• feat: automate patch releases for new ORAS CLI versions by @​Brilly-Bohyun in oras-project/setup-oras#205

New Contributors

• @​arpitjain099 made their first contribution in oras-project/setup-oras#200
• @​Brilly-Bohyun made their first contribution in oras-project/setup-oras#205

Full Changelog: oras-project/setup-oras@v2.0.1...v2.0.2

Commits

• 005458a feat: automate patch releases for new ORAS CLI versions (#205)
• 9f241ed chore(deps): Bump @​types/node from 26.6.1 to 26.6.2 (#203)
• 931fc54 chore(deps): Bump @​types/node from 26.5.1 to 26.6.1 (#202)
• f629924 chore(deps): Bump @​types/node from 26.4.1 to 26.5.1 (#201)
• ccb7116 Raise the undici override floor to 8.9.0 (#200)
• 52b6f72 chore(deps): Bump @​types/node from 26.4.0 to 26.4.1 (#196)
• 39b47eb chore(deps): Bump apache/skywalking-eyes from 0.8.0 to 0.9.0 (#194)
• 47f8aa9 chore(deps): Bump @​types/node from 26.2.0 to 26.4.0 (#193)
• 8fb134d chore: update releases.json for 1.3.4 (#192)
• 47a14f7 chore(deps): Bump @​types/node from 26.1.2 to 26.2.0 (#190)
• Additional commits viewable in compare view

Updates github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml from 2.0.0 to 2.2.0

Release notes

Sourced from github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml's releases.

v2.2.0

Changelog

🚀 Features

• feat(release): list every pull request on a repository's first release @​jmeridth (#206)

🧰 Maintenance

• chore(deps): bump mikefarah/yq from 4.53.6 to 4.54.1 in the dependencies group @dependabot[bot] (#207)

See details of all code changes since previous release

v2.1.1

Changelog

🐛 Bug Fixes

• fix(release): check the release tag before creating a draft @​jmeridth (#204)

🧰 Maintenance

• chore(deps): bump alpine from 3.24.1 to 3.24.2 @dependabot[bot] (#203)

See details of all code changes since previous release

v2.1.0

Changelog

🚀 Features

• feat(release): add version-file input to read the release version from a file @​jmeridth (#200)

🧰 Maintenance

• chore(deps): bump the dependencies group with 2 updates @dependabot[bot] (#199)
• chore(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 in the dependencies group @dependabot[bot] (#198)
• chore(deps): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 in the dependencies group @dependabot[bot] (#197)
• chore(deps): bump mikefarah/yq from 4.53.4 to 4.53.6 in the dependencies group @dependabot[bot] (#196)
• chore(deps): bump mikefarah/yq from 4.53.3 to 4.53.4 in the dependencies group @dependabot[bot] (#195)
• chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the dependencies group @dependabot[bot] (#194)

See details of all code changes since previous release

Commits

• 690dbbe feat(release): list every pull request on a repository's first release (#206)
• 5dd6bcc chore(deps): bump mikefarah/yq (#207)
• 038160c fix(release-draft): check the release tag before creating a draft (#204)
• 967911e chore(deps): bump alpine from 3.24.1 to 3.24.2 (#203)
• a48c75f feat(release): add version-file input to read the release version from a file...
• d2ccab6 chore(deps): bump the dependencies group with 2 updates (#199)
• 1a25a97 chore(deps): bump step-security/harden-runner in the dependencies group (#198)
• 3947452 chore(deps): bump anchore/sbom-action/download-syft (#197)
• 13dfb3e chore(deps): bump mikefarah/yq in the dependencies group (#196)
• bae3fae chore(deps): bump mikefarah/yq in the dependencies group (#195)
• Additional commits viewable in compare view

Updates revanite-io/osps-baseline-action from 1.5.0 to 1.5.2

Release notes

Sourced from revanite-io/osps-baseline-action's releases.

v1.5.2

Changelog

🐛 Bug Fixes

• fix: parse multi-digit control counts in the workflow summary @​jmeridth (#65)
• fix: upload SARIF before failing on failed controls @​jmeridth (#62)

🧰 Maintenance

• chore(deps): bump the dependencies group with 4 updates @dependabot[bot] (#63)
• docs: point README examples at v1.5.1 @​jmeridth (#60)

See details of all code changes since previous release

v1.5.1

Changelog

🧰 Maintenance

• chore(deps): bump pvtr-github-repo-scanner image to v0.31.0 @​jmeridth (#59)
• docs: update pvtr repository link @​jmeridth (#58)
• chore(deps): bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1 in the dependencies group @dependabot[bot] (#57)
• chore(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 in the dependencies group @dependabot[bot] (#56)
• chore(deps): bump the dependencies group with 2 updates @dependabot[bot] (#55)

See details of all code changes since previous release

Commits

• 1af7ff8 Merge pull request #65 from revanite-io/fix/summary-count-parsing
• 3713c96 fix: parse multi-digit control counts in the workflow summary
• 6c25955 Merge pull request #63 from revanite-io/dependabot/github_actions/dependencie...
• f345c95 chore(deps): bump the dependencies group with 4 updates
• 3527b4e Merge pull request #62 from revanite-io/fix/sarif-upload-before-fail-on-error
• 5967f2a fix: upload SARIF before failing on failed controls
• e52570a Merge pull request #60 from revanite-io/docs/readme-v1.5.1
• 84984dd docs: point README examples at v1.5.1
• cfa60b1 Merge pull request #59 from revanite-io/chore/bump-scanner-v0.31.0
• f5aa0f1 chore(deps): bump pvtr-github-repo-scanner image to v0.31.0
• Additional commits viewable in compare view

Updates github/codeql-action/init from 4.38.0 to 4.38.2

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits

• 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
• 8ad03a3 Trigger workflows
• 98af865 Update changelog for v4.38.2
• a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
• 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
• 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
• f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
• 5e4e255 Rebuild
• b13f5f4 Bump ruby/setup-ruby
• c87fe57 Rebuild
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.38.0 to 4.38.2

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.2

• Update default CodeQL bundle version to 2.27.1. #4160

v4.38.1

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.3 - 08 Oct 2026

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
• Update default CodeQL bundle version to 2.27.2. #4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

4.38.2 - 24 Sept 2026

• Update default CodeQL bundle version to 2.27.1. #4160

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

... (truncated)

Commits

• 2892aa5 Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f
• 8ad03a3 Trigger workflows
• 98af865 Update changelog for v4.38.2
• a6ef2c9 Merge pull request #4156 from github/mario-campos/fix-validate-cmd
• 1ef28a1 Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...
• 26cb08b Merge pull request #4163 from github/mbg/fix-getCommitOid-stubs
• f035ce3 Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...
• 5e4e255 Rebuild
• b13f5f4 Bump ruby/setup-ruby
• c87fe57 Rebuild
• Additional commits viewable in compare view

Updates step-security/harden-runner from 2.21.1 to 2.22.0

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.0

What's Changed

• Linux ARM64 support for community tier
• GHES support for self-hosted VMs (enterprise tier)
• MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

Commits

• 351661c Merge pull request #701 from step-security/rc-44
• 1dc7f2e Merge pull request #702 from h0x0er/jatin/ghes-changes-up
• af5ca38 simplified ghes config creation
• 9a6d710 fix2
• 74c65ea fix
• ceac816 resovled comments
• 2439321 refactoring for codebuild
• e28e09b Revert "job summary fixes for ghes"
• e38f7a0 job summary fixes for ghes
• 468d34b fixed insights url for ghes scenario
• Additional commits viewable in compare view

Updates release-drafter/release-drafter from 7.7.0 to 7.9.0

Release notes

Sourced from release-drafter/release-drafter's releases.

v7.9.0

What's Changed

New

• feat(autolabeler): sync configured pull request labels (#1787) @​jetersen
• feat(autolabeler): support multiple labels, stop rules and fallback (#1785) @​jetersen
• feat: expose PR labels in Drafter and Check PR outputs (#1782) @​jetersen
• feat: add resolved tag template variable (#1784) @​jetersen

Dependency Updates

• ci(deps): update reviewdog/action-actionlint action to v1.77.0 (#1781) @​renovate[bot]

Bug Fixes

• fix(config): provide standard loading for the programmatic API (#1783) @​jetersen
• fix: skip the missing-baseline warning when from is set (#1789) @​jmeridth

Maintenance

• ci: dogfood Release Drafter and stage npm publishing (#1778) @​jetersen
• ci: lint GitHub Actions workflows with actionlint (#1780) @​jetersen

New Contributors

• No new contributors

Full Changelog: release-drafter/release-drafter@v7.8.0...v7.9.0

v7.8.0

What's Changed

Token authentication change

The token action input now takes precedence over env.GITHUB_TOKEN and defaults to ${{ github.token }}. Pass a PAT or GitHub App token through with.token, especially when publishing releases that should trigger downstream workflows:

with:
  token: ${{ secrets.PAT }}
  publish: true

New

• feat: merge repeated changes with group-changes (#1725) @​slawekjaranowski, @​claude
• feat(facade): wire multiforge adapters (#1709) @​jetersen
• feat(adapters): add GitLab REST adapter (#1708) @​jetersen
• feat(adapters): add Gitea and Forgejo REST adapters (#1707) @​jetersen
• feat: add config-driven check-pr validation (#1706) @​jetersen

... (truncated)

Commits

• 72967cd chore: release v7.9.0 (#1790)
• 43cd2a9 feat(autolabeler): sync configured pull request labels (#1787)
• a99850f feat(autolabeler): support multiple labels, stop rules and fallback (#1785)
• 26b7080 feat: expose PR labels in Drafter and Check PR outputs (#1782)
• 58b89af feat: add resolved tag template variable (#1784)
• 7aa25ba fix(config): provide standard loading for the programmatic API (#1783)
• 1e80012 fix: skip the missing-baseline warning when from is set (#1789)
• 57f4179 ci: dogfood Release Drafter and stage npm publishing (#1778)
• 75620c0 ci(deps): update reviewdog/action-actionlint action to v1.77.0 (#1781)
• fb48a58 ci: lint GitHub Actions workflows with actionlint (#1780)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, github_actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.